Although that said, bluetooth would need to be enabled, and attacker would have to be local. So maybe it is a sec-high. Either way I think we need to get this on 1.3, especially since its already patched and the patch is public.